Tax strategist
penetration tester
Security-Ops
Private beta
An autonomous AI pentester that only fires on targets you can prove you own, then exploits, verifies, and hands off.
Ask for a seat
You'll land in your workspace; pick the employee there.
Access
We run it in production inside Magic Unicorn, behind single sign-on. It isn't public yet, and we only test against deliberately vulnerable practice targets, never anyone's live systems. Book a walkthrough and we'll show you a live run.
Operating boundary: Authorized targets only. Every scan is gated by engagement scope and target attestation.
The work
What it does
- Runs a full pentest on its own: finds the hole, writes the exploit, and reproduces the proof of concept, not just a severity score.
- Refuses to fire unless the engagement is active, the target is in scope, and you've proven you own it, all checked server-side before any scan starts.
- Runs four scanners today behind one gate (Strix, Nuclei, Trivy, Gitleaks) and normalizes every result into a single finding model, with cloud posture landing next.
The workflow
How it works
- 01
Create an engagement and register your target.
- 02
Prove you own it with a DNS record, file drop, or HTTP header, then activate the scope.
- 03
Launch the run. It sweeps, exploits, verifies, and hands findings to your team.
Source record
A claim with a source
Live behind single sign-on at security-ops.magicunicorn.dev, running real internal engagements.
Keep exploring
Related employees
For humans and for agents
Bring your own agent.
Unicorn Commander is built for people and agents. Start with the connection details and the permissions for the product you want to use.
Machine discovery
/.well-known/agent-card.json
The card describes the available identity and capabilities. It does not grant anonymous access.
A useful next step
Need a guided fit?
Start with the job, the product state, and the way you want to run it.